Skip to content

[Security] Bump underscore from 1.12.0 to 1.12.1 #26340

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

[Security] Bump underscore from 1.12.0 to 1.12.1 #26340

wants to merge 1 commit into from

Conversation

@dependabot-preview
Copy link
Contributor

@dependabot-preview dependabot-preview bot commented Mar 27, 2021 •
edited
Loading

Bumps underscore from 1.12.0 to 1.12.1.

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will merge this PR once CI passes on it, as requested by @nextcloud-bot.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Automerge options (never/patch/minor, and dev/runtime dependencies)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

@dependabot-preview dependabot-preview bot added this to the Nextcloud 22 milestone Mar 27, 2021
nextcloud-bot
nextcloud-bot approved these changes Mar 27, 2021
View reviewed changes
Copy link
Member

@nextcloud-bot nextcloud-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dependabot merge

@dependabot-preview
Copy link
Contributor Author

One of your CI runs failed on this pull request, so Dependabot won't merge it.

Dependabot will still automatically merge this pull request if you amend it and your tests pass.

@dependabot-preview dependabot-preview bot force-pushed the dependabot/npm_and_yarn/underscore-1.12.1 branch from db26cfd to 8dc404e Compare March 29, 2021 08:36
nextcloud-bot
nextcloud-bot approved these changes Mar 29, 2021
View reviewed changes
Copy link
Member

@nextcloud-bot nextcloud-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dependabot merge

@rullzer
Copy link
Member

rullzer commented Mar 29, 2021

/compile amend /

@npmbuildbot-nextcloud npmbuildbot-nextcloud bot force-pushed the dependabot/npm_and_yarn/underscore-1.12.1 branch from 8dc404e to c9ac90e Compare March 29, 2021 19:22
@kesselb
Copy link
Collaborator

kesselb commented Apr 6, 2021

@dependabot recreate

@dependabot-preview dependabot-preview bot force-pushed the dependabot/npm_and_yarn/underscore-1.12.1 branch from c9ac90e to b997427 Compare April 6, 2021 12:47
nextcloud-bot
nextcloud-bot approved these changes Apr 6, 2021
View reviewed changes
Copy link
Member

@nextcloud-bot nextcloud-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dependabot merge

@juliusknorr
Copy link
Member

/compile amend /

@npmbuildbot-nextcloud npmbuildbot-nextcloud bot force-pushed the dependabot/npm_and_yarn/underscore-1.12.1 branch from b997427 to 31a163f Compare April 6, 2021 14:38
@rullzer
Copy link
Member

rullzer commented Apr 9, 2021

@dependabot-bot recreate

@dependabot-preview dependabot-preview bot force-pushed the dependabot/npm_and_yarn/underscore-1.12.1 branch from 31a163f to 75f26f1 Compare April 9, 2021 07:46
nextcloud-bot
nextcloud-bot approved these changes Apr 9, 2021
View reviewed changes
Copy link
Member

@nextcloud-bot nextcloud-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dependabot merge

@rullzer
Copy link
Member

rullzer commented Apr 9, 2021

/compile amend /

@npmbuildbot-nextcloud npmbuildbot-nextcloud bot force-pushed the dependabot/npm_and_yarn/underscore-1.12.1 branch from 75f26f1 to 85d8567 Compare April 9, 2021 07:57
@dependabot-preview
Copy link
Contributor Author

A newer version of underscore exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

@dependabot-preview
Copy link
Contributor Author

We've just been alerted that this update fixes a security vulnerability:

Sourced from The GitHub Security Advisory Database.

Arbitrary Code Execution in underscore

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Affected versions: [">= 1.3.2 < 1.12.1"]

@dependabot-preview dependabot-preview bot changed the title Bump underscore from 1.12.0 to 1.12.1 [Security] Bump underscore from 1.12.0 to 1.12.1 May 6, 2021
@MorrisJobke MorrisJobke mentioned this pull request May 20, 2021
Merged
@MorrisJobke
Copy link
Member

@dependabot recreate

@dependabot-preview dependabot-preview bot force-pushed the dependabot/npm_and_yarn/underscore-1.12.1 branch from 85d8567 to 77af277 Compare May 21, 2021 14:52
nextcloud-bot
nextcloud-bot approved these changes May 21, 2021
View reviewed changes
Copy link
Member

@nextcloud-bot nextcloud-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dependabot merge

@dependabot-preview dependabot-preview bot force-pushed the dependabot/npm_and_yarn/underscore-1.12.1 branch from 77af277 to df0b131 Compare May 22, 2021 02:34
nextcloud-bot
nextcloud-bot approved these changes May 22, 2021
View reviewed changes
Copy link
Member

@nextcloud-bot nextcloud-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dependabot merge

@kesselb
Copy link
Collaborator

kesselb commented May 24, 2021

/compile amend /

@dependabot-preview @npmbuildbot-nextcloud
Bump underscore from 1.12.0 to 1.12.1
155bcc4 
Bumps [underscore](https://github.com/jashkenas/underscore) from 1.12.0 to 1.12.1.
- [Release notes](https://github.com/jashkenas/underscore/releases)
- [Commits](https://github.com/jashkenas/underscore/commits)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
Signed-off-by: npmbuildbot-nextcloud[bot] <npmbuildbot-nextcloud[bot]@users.noreply.github.com>
@npmbuildbot-nextcloud npmbuildbot-nextcloud bot force-pushed the dependabot/npm_and_yarn/underscore-1.12.1 branch from df0b131 to 155bcc4 Compare May 24, 2021 19:19
@MorrisJobke MorrisJobke mentioned this pull request May 26, 2021
Merged
98 tasks
@skjnldsv
Copy link
Member

@dependabot recreate

@dependabot-preview
Copy link
Contributor Author

This repository is now using a version: 2 config so Dependabot Preview can no longer make changes to this pull request. You can close it and let Dependabot re-create it the next time it checks for updates.

@skjnldsv skjnldsv closed this May 28, 2021
@dependabot-preview
Copy link
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot-preview dependabot-preview bot deleted the dependabot/npm_and_yarn/underscore-1.12.1 branch May 28, 2021 16:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ChristophWurst ChristophWurst ChristophWurst approved these changes

@nextcloud-bot nextcloud-bot nextcloud-bot approved these changes

@github-actions github-actions[bot] github-actions[bot] approved these changes

@juliusknorr juliusknorr Awaiting requested review from juliusknorr

@skjnldsv skjnldsv Awaiting requested review from skjnldsv

Assignees

No one assigned

Labels

3. to review Waiting for reviews feature: dependencies javascript security

Projects

None yet

Milestone

Nextcloud 22

Development

Successfully merging this pull request may close these issues.

7 participants

@rullzer @kesselb @juliusknorr @MorrisJobke @skjnldsv @ChristophWurst @nextcloud-bot